Romain Tartière <romain_at_FreeBSD.org> wrote on Date: Sat, 02 Aug 2025 05:31:12 UTC :
> Romain Tartière <romain_at_FreeBSD.org> > Date: Sat, 02 Aug 2025 05:31:12 UTC > The branch stable/14 has been updated by romain: > > URL: > https://cgit.FreeBSD.org/src/commit/?id=8d4464377219dcf45e87510b73767c9ec3515bc2 > > commit 8d4464377219dcf45e87510b73767c9ec3515bc2 > Author: Romain Tartière <rom...@freebsd.org> > AuthorDate: 2025-07-25 18:31:57 +0000 > Commit: Romain Tartière <rom...@freebsd.org> > CommitDate: 2025-08-02 05:30:18 +0000 > > vm_page: Fix loading bad memory addresses from file > > When loading bad memory addresses from a file, we are passed an end > pointer that points on the first byte after the buffer. We want the > buffer to be null-terminated (by changing the last byte to \0 if it is > reasonable to do so), so adjust the end pointer to be on that byte. > > Approved by: kib, markj > MFC after: 1 week > Differential Revision: https://reviews.freebsd.org/D51433 > > (cherry picked from commit 202f8bde836dc86627be2b5b98174d9a0fb2eaba) > --- > sys/vm/vm_page.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/sys/vm/vm_page.c b/sys/vm/vm_page.c > index ac922f4a3bc8..f013cbc84c25 100644 > --- a/sys/vm/vm_page.c > +++ b/sys/vm/vm_page.c > @@ -393,7 +393,7 @@ vm_page_blacklist_load(char **list, char **end) > } > *list = ptr; > if (ptr != NULL) > - *end = ptr + len; > + *end = ptr + len - 1; This looks wrong to me if/when len==0 is possible. It looks possible, see below. > else > *end = NULL; > return; > return; More context, original code(from main): . . . mod = preload_search_by_type("ram_blacklist"); if (mod != NULL) { ptr = preload_fetch_addr(mod); len = preload_fetch_size(mod); } *list = ptr; if (ptr != NULL) *end = ptr + len; else *end = NULL; return; . . . But in /usr/src/sys/kern/subr_module.c : size_t preload_fetch_size(caddr_t mod) { size_t *mdp; mdp = (size_t *)preload_search_info(mod, MODINFO_SIZE); if (mdp == NULL) return (0); return (*mdp); } Note the "return (0);" (possibly *mdp==0 as well when mdp!=0 ?). Then, for that return, showing the substitution: + *end = ptr + 0 - 1; Simplifying for the specific case: + *end = ptr - 1; That looks likely to be wrong to me. === Mark Millard marklmi at yahoo.com
